UNIX for Dummies Questions & Answers

Hello,

For one of our servers, we have had people trying to illegally loggon using the ssh service.
My manager has asked me to restrict ssh access to users in our internal network but close ssh access to the "outside" world.

Could someone at the very least point me to some resources on the net which could be of some use to me? There is no point asking for someone to answer such a grandiose question but getting pointed in the right direction would be appreciated.

Thanks,

in /etc/ssh/sshd_config

man sshd_config

set:

ListenAddress to you local network.

ListenAddress 192.168.0.0

Not sure what your Linux/Unix version is, but you could use a firewall like iptables or ipfilter to restrict access to the sshd server port. Also, some versions of sshd use tcp wrappers, so you could use hosts.deny to define restrictions.

Okay. I actually know the IP address of the FIREWALL I would have to block. How would I go about doing that? The Denygroups is a possibility based on the man page but I would like to use a command that blocks an IP address....

I am using CentOS release 5 (Final)
And I am using OPENSSH.

Which strategy should I take?

sshd uses tcp wrappers on CentOS/RHEL. Use /etc/hosts.allow and /etc/hosts.deny

/etc/hosts.allow should have the IP range to allow:

Code:

sshd: 192.168.0.

This allows all hosts o nthe 192.168.0. subnet as an example

/etc/hosts.deny should have this entry:

Code:

sshd: ALL

This denies anyone who isn't defined in hosts.allow

if i only configure the file: hosts.deny, is it okay?
because i access the server from different locations.

moreover, i know the ip/network to block. So if configure the hosts.deny file with the following line without touching the hosts.allow file. Is it okay?

sshd: 192.168.60.60 // ip to block

or/and

sshd: 123.something.something // network to block